Vulnerability CVE-2012-2746

Vulnerability Name:

CVE-2012-2746 (CCN-76595)

Assigned:

2012-05-10

Published:

2012-05-10

Updated:

2017-09-19

Summary:

389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

2.1 Low (CVSS v2 Vector: AV:N/AC:H/Au:S/C:P/I:N/A:N)
1.6 Low (Temporal CVSS v2 Vector: AV:N/AC:H/Au:S/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

1.2 Low (REDHAT CVSS v2 Vector: AV:L/AC:H/Au:N/C:P/I:N/A:N)
0.9 Low (REDHAT Temporal CVSS v2 Vector: AV:L/AC:H/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): High Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

CWE-310

Vulnerability Consequences:

Obtain Information

References:

Vulnerable Configuration:

Configuration 1:

cpe:/a:redhat:directory_server:7.1:*:*:*:*:*:*:*

OR cpe:/a:redhat:directory_server:8.0:*:*:*:*:*:*:*

OR cpe:/a:redhat:directory_server:8.1:*:*:*:*:*:*:*

OR cpe:/a:redhat:directory_server:*:*:*:*:*:*:*:* (Version <= 8.2)

Configuration 2:

cpe:/a:fedoraproject:389_directory_server:1.2.1:*:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.2:*:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.3:*:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.5:*:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.5:rc1:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.5:rc2:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.5:rc3:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.5:rc4:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.6:*:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.6:a2:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.6:a3:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.6:a4:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.6:rc1:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.6:rc2:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.6:rc3:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.6:rc6:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.6:rc7:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.6.1:*:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.7:alpha3:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.7.5:*:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.8:alpha1:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.8:alpha2:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.8:alpha3:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.8:rc1:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.8:rc2:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.8.1:*:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.8.2:*:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.8.3:*:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.9.9:*:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.10:alpha8:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.10:rc1:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.10.1:*:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.10.2:*:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.10.3:*:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.10.4:*:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.10.7:*:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:1.2.11.1:*:*:*:*:*:*:*

OR cpe:/a:fedoraproject:389_directory_server:*:*:*:*:*:*:*:* (Version <= 1.2.11.5)

Configuration RedHat 1:

cpe:/o:redhat:enterprise_linux:6:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/o:redhat:enterprise_linux:6::client:*:*:*:*:*

Configuration RedHat 3:

cpe:/o:redhat:enterprise_linux:6::computenode:*:*:*:*:*

Configuration RedHat 4:

cpe:/o:redhat:enterprise_linux:6::server:*:*:*:*:*

Configuration RedHat 5:

cpe:/o:redhat:enterprise_linux:6::workstation:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:19241	V	HP-UX Directory Server, Remote Disclosure of Information	2015-04-20
oval:org.mitre.oval:def:23785	P	ELSA-2012:0997: 389-ds-base security update (Moderate)	2014-05-26
oval:org.mitre.oval:def:21476	P	RHSA-2012:0997: 389-ds-base security update (Moderate)	2014-02-24
oval:com.ubuntu.xenial:def:201227460000000	V	CVE-2012-2746 on Ubuntu 16.04 LTS (xenial) - medium.	2012-07-03
oval:com.ubuntu.precise:def:20122746000	V	CVE-2012-2746 on Ubuntu 12.04 LTS (precise) - medium.	2012-07-03
oval:com.ubuntu.trusty:def:20122746000	V	CVE-2012-2746 on Ubuntu 14.04 LTS (trusty) - medium.	2012-07-03
oval:com.ubuntu.xenial:def:20122746000	V	CVE-2012-2746 on Ubuntu 16.04 LTS (xenial) - medium.	2012-07-03
oval:com.redhat.rhsa:def:20120997	P	RHSA-2012:0997: 389-ds-base security update (Moderate)	2012-06-20

BACK